CVE-2025-55179
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk6th percentile - higher than 6% of all known CVEs
Summary
Incomplete validation of rich response messages in WhatsApp for iOS prior to v2.25.23.73, WhatsApp Business for iOS v2.25.23.82, and WhatsApp for Mac v2.25.23.83 could have allowed a user to trigger processing of media content from an arbitrary URL on another user's device. No evidence of exploitation in the wild has been observed.
Risk Assessment
An attacker could cause another user's device to fetch and process media content from an arbitrary URL, potentially leaking network or IP address information about the victim. There is no evidence of active exploitation, but the risk exists.
Recommendation
Update WhatsApp for iOS to v2.25.23.73 or later, WhatsApp Business for iOS to v2.25.23.82 or later, and WhatsApp for Mac to v2.25.23.83 or later. Inform users about the need to update.
Other vulnerabilities in WhatsApp
See all- CVE-2025-55177MediumActively exploited
Incomplete authorization of linked device synchronization messages in WhatsApp for iOS prior to v2.25.21.73, WhatsApp Business for iOS v2.25.21.78, and WhatsApp for Mac v2.25.21.78 could have allowed an unrelated user to trigger processing of content from an arbitrary URL on a target's device. This vulnerability, combined with an OS-level vulnerability on Apple platforms (CVE-2025-43300), may have been exploited in a sophisticated attack against specific targeted users.
- CVE-2019-3568CriticalActively exploited
A buffer overflow vulnerability in the WhatsApp VOIP stack allows remote code execution via specially crafted RTCP packets sent to a target phone number.
Original NVD description (English source)
Incomplete validation of rich response messages in WhatsApp for iOS prior to v2.25.23.73, WhatsApp Business for iOS v2.25.23.82, and WhatsApp for Mac v2.25.23.83 could have allowed a user to trigger processing of media content from an arbitrary URL on another user’s device. We have not seen evidence of exploitation in the wild.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS